21–30 of 227 posts
Obvious question - What happens when the phone containing the private key is lost?
https://krypt.co/faq/
Does this allow me to ssh into my server, for example, a shell server on the internet? If so, how does the server contact my phone? Through your server, right? What software do I install on the server for that?
I found the answer on your blog: > Our system consists of three components: > (1) the Kryptonite phone app for iOS and Android, > (2) the krd daemon that runs in the background on a macOS or Linux computer, and > (3) the kr command line utility that manages krd. ...from https://blog.krypt.co/the-kryptonite-architecture-a385e7aaa3... Sounds like `krd` is why I likely won't be using this. Try implementing it as a PAM m…
So my suggestion re: PAM is irrelevant because you aren't changing the server, you're changing the client.
Ok, I'm interested ...maybe... I'll wait until people more familiar with ssh-agent chime in. :)
Hey HN! We've built a way to generate an SSH key on your phone and use it from your computer such that the private key never leaves the phone. We were inspired by the threat model of USB HSMs like the Yubikey and set out to build a free, public source, and easier to use BYOD alternative. Looking forward to your questions!
Some questions & comments: * Can you have multiple private keys (site specific?)? * Does the Android client support ed25519 keys or is it iOS only? * Please modify your curl statement to be something like how Honeycomb does it (that is include a checksum test). https://honeycomb.io/docs/connect/nginx/
2) Android doesn't yet support ed25519 but it is coming.
3) We would consider something like this but the question is how that checksum test itself is served. We'll definitely look into improving this. The curl script itself does check the hashes of the installed binaries downloaded from github.
Your FAQ says you cannot backup your private key. So does that mean if your service gets attacked by DDoS or has unexpected downtime, you will not be able to SSH into your server?
Earlier quoted context omitted.
https://krypt.co/faq/
First make sure you remove the old SSH public key from any of your accounts. Once you have Kryptonite installed on your new phone, add the new public key to the accounts you were using SSH with before.
Earlier quoted context omitted.
No -- we treat every communication channel as untrusted. All communication between the phone and computer is encrypted with session keys established when you pair by scanning the QR code in the terminal. Check out our architecture post for more details: https://blog.krypt.co/the-kryptonite-architecture-a385e7aaa3...
If I'm reading this, the answer is actually ~Yes? The requests pass via SQS/SNS run by Kryptonite, or via Bluetooth not run by kryptonite?
Does this allow me to ssh into my server, for example, a shell server on the internet? If so, how does the server contact my phone? Through your server, right? What software do I install on the server for that?
I found the answer on your blog: > Our system consists of three components: > (1) the Kryptonite phone app for iOS and Android, > (2) the krd daemon that runs in the background on a macOS or Linux computer, and > (3) the kr command line utility that manages krd. ...from https://blog.krypt.co/the-kryptonite-architecture-a385e7aaa3... Sounds like `krd` is why I likely won't be using this. Try implementing it as a PAM m…